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UNITED STATES DISTRICT COURT 
NORTHERN DISTRICT OF CALIFORNIA, SAN FRANCISCO DIVISION 


WAYMO LLC, 

Plaintiff, 

CASE NO. 3:17-cv-00939 

vs. 

UBER TECHNOLOGIES, INC.; 

DECLARATION OF GARY BROWN 

OTTOMOTTO LLC; OTTO TRUCKING 

LLC, 

Defendants. 

REDACTED VERSION OF DOCUMENT 
SOUGHT TO BE SEALED 
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I, Gary Brown, hereby declare as follows. 

1. I have been employed by Google Inc. (“Google”) since August 2013. I currently 
hold the position of Security Engineer, Forensics. I make this declaration in support of Waymo’s 
Motion for a Preliminary Injunction and have personal knowledge of the facts stated herein. 

2. I received an M.S. in Enterprise Computing and a B.S. in Cybersecurity from the 
Stevens Institute of Technology. 

3. In my role as a Security Engineer in Forensics, I am responsible for gathering 
evidence, from logs and hosts, to confirm or refute suspected compromise or abuse. I am familiar 
with Google’s secure networks and with logs of activity on those networks that are maintained by 
Google in the ordinary course of its business. 

4. It is Google’s policy to assign unique identifiers to devices issued to employees for 
work purposes, such as work laptops. Among other functions, these unique identifiers help 
maintain the security of Google’s secure networks. When an employee’s device interacts with a 
Google service or is active on a Google network, those interactions and activities can be recorded 
in logs that identify the device (by its unique identifiers) and/or the interaction or activity (for 
example, downloading files from a secure repository). 


6 . 


7. 
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8. 


9. 


10 . 


11 . 


Anthony Levandowski 

12. Google issued a work laptop to Anthony Levandowski in July 2013 that was 
assigned the asset inventory tag^^^^^ (“the Levandowski work laptop”). 

13. Based on my review of host metadata, an installed Windows operating system 
on the Levandowski work laptop made no check-ins to^^| between March 2, 2015 and 
November 25, 2015, despite the^^f agent being configured to do so every 15 minutes when an 
internet connection is present. Based on my review of Google corporate network logs, the 
Levandowski work laptop’s network interfaces appeared on the Google network a total of three 
times between March 2, 2015 and November 25, 2015: for a period of approximately two hours on 
October 22, 2015, approximately two hours on November 20, 2015, and then briefly on November 
25,2015. 

14. Based on my review of^^| host and^^^^ metadata, the Windows operating 
system on the Levandowski work laptop was re-installed on November 26, 2015. 
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15. Based on my review log data, the Levandowski work laptop ran a 

MoMA search for the strings “chauffeur svn login” and “chauffeur svn eee setup” on December 3, 
2015. “Chauffeur” was the name of Google’s self-driving car project, and “SVN” refers to a 
repository used by that project which contains Waymo's design files, schematics and other 
confidential information. 

16. Based on my review of logs of Google corporate network traffic and^^ log data, 
the Levandowski work laptop downloaded and installed TortoiseSVN, which is software that can 
access the self-driving car project’s SVN repository, on December 11, 2015. 

17. Based on my review of logs from the SVN repository and of Google corporate 
network traffic, the Levandowski work laptop then downloaded over 14,000 files from the SVN 
repository, also on December 11, 2015. Based on my review of logs from the SVN repository, 
that download totaled 9.7 GBs of data, including 2 GBs from LiDAR subdirectories. 

18. Based on my review of log data, a Transcend RDF5 USB 3.0 card reader was 
attached to the Levandowski work laptop for a period of approximately eight hours on December 
14, 2015. 

19. Based on my review of host metadata in and a timeline of the hard drive of 
the Levandowski work laptop, the Levandowski work laptop was reformatted from a Windows 
operating system to a Linux operating system (Goobuntu, Google’s custom version of Ubuntu 
Linux) on December 18, 2015. 

20. Based on my review of Google machine certificate logs, Google network logs, 
Google host logs, and^^f host metadata, the Levandowski work laptop maintained a consistent 
connection on Google’s network from the time of reformat on December 18th through its last 
check-in to^^f, and obtention of a machine certificate, on December 21, 2015. The final 
appearance of the Levandowski work laptop on Google’s corporate network occurs approximately 
one minute after it obtained the machine certificate on December 21, 2015. From that point on, 
there is no further appearance of the Levandowski work laptop on Google’s corporate network, 
nor any check-ins to^^J despite the^^| agent being configured to do so every 15 minutes 
when an internet connection is present. 
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21. When a Google employee uses his or her corporate account credentials to log onto 
Google Drive, those interactions can also be recorded even if the Google employee is accessing 
Google Drive from a personal device. For example, if a Google employee “exports” (i.e., saves a 
local copy of) a document from Google Drive, that interaction will be recorded in a Drive log, 
identifying (among other things) the Google employee’s GAIA ID (a unique identification number 
assigned by Google, resolvable to a username and domain on Google’s services), the unique ID of 
the document exported, the operating system and browser in use, and the time and date of the 
export. 

22. Based on my review of Drive log data, the Google GAIA ID which 

resolves to “^^^^|@google.com” - assigned to Anthony Levandowski - exported five 
documents from Google Drive to a personal device (i.e., one that was not issued by Google) on 
January 4, 2016, over an approximately three minute period. The names of those files are: 

• Intensity Calibration 
Extrinsic Calibration 

• ^ and ^ tuning Instructions 

• Assembly Flowchart SOP 

• TESTING STATION 

23. Based on my review of Drive log data, on January 1 1, 2016, the Google GAIA ID 
- assigned to Anthony Levandowski - exported another document from Google 

Drive to a personal device. The name of this file is: 

Chauffeur TL weekly updates - Q4 2015 

Sameer Kshirsagar 

24. Based on my review of Drive log data, the Google GAIA ID - 

assigned to Sameer Kshirsagar - exported a document from Google Drive on June 3, 2016. The 
name of this file is: 

Laser questions 
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25. Based on my review of Drive log data, the Google GAIA ID | 
assigned to Sameer Kshirsagar - exported another document from Google Drive on June 14, 2016. 
The name of this file is: 

Ramp checklist 

26. Based on my review of Drive log data, the Google GAIA ID - 

assigned to Sameer Kshirsagar - exported another document from Google Drive on June 21, 2016. 
The name of this file is: 

and Packaging I 


27. Based on my review of Drive log data, the Google GAIA ID | 
assigned to Sameer Kshirsagar - exported another document from Google Drive on June 22, 2016. 
The name of this file is: 

-Lens Placement-01 


28. Based on my review of Drive log data, the Google GAIA ID - 

assigned to Sameer Kshirsagar - exported another document from Google Drive on July 12, 2016. 
The name of this file is: 

• All things ^ Part 3- mode 


Radu Raduta 

29. Based on my review of Drive log data, the Google GAIA ID - 

assigned to Radu Raduta - exported, over an approximately ten minute period, three documents 
from Google Drive on July 28, 2016. The names of those files are: 

• Die - wire bonding houses 

• External Vendors and Consultants List 

automation vendors 

I declare under penalty of perjury that the foregoing is true and correct. Executed in San 
Jose, California, on March 9, 2017. 
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DATED: March 9. 2017 
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